How secure is my data?

How secure is my data?

All data stored in Wasabi Hot Cloud Storage is secure and encrypted at REST, even if the data is already encrypted by the storage application prior to sending it to Wasabi. Wasabi follows industry-best security models and security design practices. Examples of Wasabi security features include:

• HTTPS is supported for secure upload/download of data.

• Buckets are only accessible to the bucket and object creators.

• Wasabi supports user authentication to control access to data.

• Access control mechanisms such as bucket policies and access control lists (ACLs) can be used to selectively grant permissions to users and groups of users.

For additional information on Wasabi security, review Wasabi Cloud Storage Security.

Wasabi's Methods for Encryption at Rest

Additional information on Wasabi’s encryption at rest, also known as DARE or data-at-rest-encryption, is provided below:

Wasabi system software always encrypts object data before it is written to a disk drive. Encryption is done using a AES256-bit key that can be provided in two different methods:

• If the S3 client application provides an encryption key in the S3 PUT Object Data REST request (the SSE-C approach described in Using Server-Side Encryption With Customer-Provided Keys (SSE-C), that key is used to encrypt the object data before writing to disk. After the PUT Object operation is completed, the key is discarded. The S3 client application must provide the same encryption key in an S3 GET Object REST request to access the data. The Wasabi system software does not keep a copy of the encryption key and it is only stored temporarily in memory while the object is being encrypted. For more information on the working of SSE-C with Wasabi, review How does SSE-C Encryption work with Wasabi?

• If no key is provided by the S3 client application (meaning SSE-C is not used), then a random AES256-bit key is generated using a cryptographic random routine in Wasabi's software.  A different encryption key is generated for each object stored in the system. This AES-256 bit key is stored in the meta-data secure layer of the Wasabi system until you delete that object, and is used again for decryption when you make a GET call for your object(s). That way, you get the same data back in your native format.